VIRUS FACEBOOK

jrm974 ile de la Réunion -  
Bonjour,
je crois avoir chopé un virus sur facebook, pouvez-vous m'aider?? j'ai installé RSIT et voici ce que j'ai eu comme analyse

http://ww38.toofiles.com/fr/oip/documents/txt/9950_log.html

Quelqu'un peut m'aider?? merci d'avance
Configuration: Windows Vista
Firefox 3.5.3

8 réponses

  1. crousti
    jarrive pas a me connecter on me demane mon tel et impossible de plus jahbite en quadeloupe merci ki peu maider
    1. MEDIAFORCE
      Salut,

      utilise plutôt ceci:

      --> Télécharge UsbFix (de Chiquitine29) sur ton Bureau :

      --> Lance l'installation avec les paramètres par défaut.

      --> Branche tes sources de données externes à ton PC (clé USB, disque dur externe, etc...) sans les ouvrir.

      --> Double-clique sur le raccourci UsbFix sur ton Bureau.

      --> Choisit l'option 1

      --> Le PC va redémarrer.

      --> Après redémarrage, poste le rapport UsbFix.txt

      Note : le rapport UsbFix.txt est sauvegardé à la racine du disque
      1. MEDIAFORCE
        Usbfix
        www.commentcamarche.net/.../telecharger-34066197-usbfix
        3. jrm974 ile de la Reunion
          bonjour Olivier et merci!!

          L'ordi est un peu plus rapide maintenant!

          Cependant, j'ai entendu parler de Koobface... peux-tu m'éclairer sur ce virus? si mon ordii était contaminé par ce virus, l'anti malware l'aurait-il détecté?

          Merci pour tout :-)
          2. jrm974 ile de la Reunion
            Merci Olivier 114!!!

            Voici le rapport

            Malwarebytes' Anti-Malware 1.41
            Version de la base de données: 2775
            Windows 6.0.6002 Service Pack 2, v.113

            28/10/2009 17:52:16
            mbam-log-2009-10-28 (17-52-16).txt

            Type de recherche: Examen complet (C:\|D:\|F:\|)
            Eléments examinés: 283547
            Temps écoulé: 1 hour(s), 43 minute(s), 31 second(s)

            Processus mémoire infecté(s): 0
            Module(s) mémoire infecté(s): 0
            Clé(s) du Registre infectée(s): 0
            Valeur(s) du Registre infectée(s): 1
            Elément(s) de données du Registre infecté(s): 0
            Dossier(s) infecté(s): 0
            Fichier(s) infecté(s): 1

            Processus mémoire infecté(s):
            (Aucun élément nuisible détecté)

            Module(s) mémoire infecté(s):
            (Aucun élément nuisible détecté)

            Clé(s) du Registre infectée(s):
            (Aucun élément nuisible détecté)

            Valeur(s) du Registre infectée(s):
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\desktop sms (Worm.P2P) -> Quarantined and deleted successfully.

            Elément(s) de données du Registre infecté(s):
            (Aucun élément nuisible détecté)

            Dossier(s) infecté(s):
            (Aucun élément nuisible détecté)

            Fichier(s) infecté(s):
            C:\install.exe (Trojan.Agent) -> Quarantined and deleted successfully.
            1. olivier114
              rien de grave avec ceci sa devrait passer:
              ▶ Télécharge malwarebyte's anti-malware

              ▶ Un tutoriel sera à ta disposition pour l'installer et l'utiliser correctement.

              ▶ Fais la mise à jour du logiciel (elle se fait normalement à l'installation)

              ▶ Lance une analyse complète en cliquant sur "Exécuter un examen complet"

              ▶ Sélectionnes les disques que tu veux analyser et cliques sur "Lancer l'examen"

              ▶ L'analyse peut durer un bon moment.....

              ▶ Une fois l'analyse terminée, cliques sur "OK" puis sur "Afficher les résultats"

              ▶ Vérifies que tout est bien coché et cliques sur "Supprimer la sélection" => et ensuite sur "OK"

              ▶ Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum

              * Il se pourrait que certains fichiers devront être supprimés au redémarrage du PC... Faites le en cliquant sur "oui" à la question posée
              1. chouchou
                j'ai un probleme avec mylovefacebook. que faire?
              2. chouchou
                Malwarebytes' Anti-Malware 1.46
                www.malwarebytes.org

                Version de la base de données: 4052

                Windows 5.1.2600 Service Pack 2
                Internet Explorer 6.0.2900.2180

                20-10-2010 16:48:55
                mbam-log-2010-10-20 (16-48-55).txt

                Type d'examen: Examen complet (C:\|D:\|)
                Elément(s) analysé(s): 134961
                Temps écoulé: 28 minute(s), 27 seconde(s)

                Processus mémoire infecté(s): 1
                Module(s) mémoire infecté(s): 1
                Clé(s) du Registre infectée(s): 44
                Valeur(s) du Registre infectée(s): 4
                Elément(s) de données du Registre infecté(s): 5
                Dossier(s) infecté(s): 15
                Fichier(s) infecté(s): 32

                Processus mémoire infecté(s):
                C:\Documents and Settings\Administrateur\Application Data\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe (Rogue.Eorezo) -> Unloaded process successfully.

                Module(s) mémoire infecté(s):
                C:\Program Files\AutocompletePro\AutocompletePro.dll (Adware.PredictAd) -> Delete on reboot.

                Clé(s) du Registre infectée(s):
                HKEY_CLASSES_ROOT\TypeLib\{01bcb858-2f62-4f06-a8f4-48f927c15333} (Adware.PredictAd) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\Interface\{c9ae652b-8c99-4ac2-b556-8b501182874e} (Adware.PredictAd) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{0fb6a909-6086-458f-bd92-1f8ee10042a0} (Adware.PredictAd) -> Quarantined and deleted successfully.
                HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0fb6a909-6086-458f-bd92-1f8ee10042a0} (Adware.PredictAd) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0fb6a909-6086-458f-bd92-1f8ee10042a0} (Adware.PredictAd) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\bvjtuzrjfqv.mynshandler (Spyware.AdaEbook) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{e8cfc029-8420-4eae-adef-915bdc77e1dc} (Spyware.AdaEbook) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
                HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\5qriuov (Adware.AdRotator) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\AppID\AutocompletePro.DLL (Adware.PredictAd) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwwin.exe (Security.Hijack) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.Exe (Trojan.Agent) -> Quarantined and deleted successfully.
                HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live-Player (Malware.Trace) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                HKEY_CURRENT_USER\SOFTWARE\AppDataLow\HavingFunOnline (Adware.BHO.FL) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe (Security.Hijack) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safari.exe (Security.Hijack) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe (Security.Hijack) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe (Security.Hijack) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe (Security.Hijack) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe (Security.Hijack) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe (Security.Hijack) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trjscan.exe (Security.Hijack) -> Quarantined and deleted successfully.

                Valeur(s) du Registre infectée(s):
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\softwarehelper (Rogue.Eorezo) -> Quarantined and deleted successfully.
                HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kanef (Worm.SFDC) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\forceclassiccontrolpanel (Hijack.ControlPanelStyle) -> Delete on reboot.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xp-f3eb8848 (Trojan.Agent) -> Quarantined and deleted successfully.

                Elément(s) de données du Registre infecté(s):
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
                HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel\Homepage (Hijack.Homepage) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

                Dossier(s) infecté(s):
                C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                C:\Program Files\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                C:\Program Files\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                C:\Program Files\FunWebProducts\Shared (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                C:\Program Files\AutocompletePro (Adware.PredictAd) -> Delete on reboot.
                C:\Program Files\AutocompletePro\chrome (Adware.PredictAd) -> Quarantined and deleted successfully.
                C:\Program Files\AutocompletePro\support@predictad.com (Adware.PredictAd) -> Quarantined and deleted successfully.
                C:\Program Files\AutocompletePro\support@predictad.com\chrome (Adware.PredictAd) -> Quarantined and deleted successfully.
                C:\Program Files\AutocompletePro\support@predictad.com\chrome\content (Adware.PredictAd) -> Quarantined and deleted successfully.
                C:\Program Files\AutocompletePro\support@predictad.com\defaults (Adware.PredictAd) -> Quarantined and deleted successfully.
                C:\Program Files\AutocompletePro\support@predictad.com\defaults\preferences (Adware.PredictAd) -> Quarantined and deleted successfully.

                Fichier(s) infecté(s):
                C:\Documents and Settings\Administrateur\Application Data\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
                C:\Program Files\AutocompletePro\AutocompletePro.dll (Adware.PredictAd) -> Delete on reboot.
                C:\Documents and Settings\Administrateur\Application Data\EoRezo\SoftwareUpdate\SoftwareUpdate.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
                C:\Documents and Settings\Administrateur\Local Settings\Temp\Répertoire temporaire 1 pour u.zip\u98.exe (Adware.UltraReach) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\5qRiUOV.exe (Adware.AdRotator) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\dp1.fne (Worm.AutoRun) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\eAPI.fne (Worm.AutoRun) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\com.run (Worm.AutoRun) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\RegEx.fne (Worm.Autorun) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\krnln.fnr (Trojan.Agent) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\shell.fne (Worm.AutoRun) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\C360CF\dp1.fne (Worm.Autorun) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\C360CF\internet.fne (HackTool.Patcher) -> Quarantined and deleted successfully.
                C:\Program Files\MyWebSearch\bar\History\search3 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                C:\Program Files\AutocompletePro\FireFoxExtension.exe (Adware.PredictAd) -> Quarantined and deleted successfully.
                C:\Program Files\AutocompletePro\InstTracker.exe (Adware.PredictAd) -> Quarantined and deleted successfully.
                C:\Program Files\AutocompletePro\unins000.dat (Adware.PredictAd) -> Quarantined and deleted successfully.
                C:\Program Files\AutocompletePro\unins000.exe (Adware.PredictAd) -> Quarantined and deleted successfully.
                C:\Program Files\AutocompletePro\chrome\autocompleteprochrome.crx (Adware.PredictAd) -> Quarantined and deleted successfully.
                C:\Program Files\AutocompletePro\support@predictad.com\chrome.manifest (Adware.PredictAd) -> Quarantined and deleted successfully.
                C:\Program Files\AutocompletePro\support@predictad.com\install.rdf (Adware.PredictAd) -> Quarantined and deleted successfully.
                C:\Program Files\AutocompletePro\support@predictad.com\chrome\content\browserOverlay.xul (Adware.PredictAd) -> Quarantined and deleted successfully.
                C:\Program Files\AutocompletePro\support@predictad.com\chrome\content\options.js (Adware.PredictAd) -> Quarantined and deleted successfully.
                C:\Program Files\AutocompletePro\support@predictad.com\chrome\content\options.xul (Adware.PredictAd) -> Quarantined and deleted successfully.
                C:\Program Files\AutocompletePro\support@predictad.com\chrome\content\utils.js (Adware.PredictAd) -> Quarantined and deleted successfully.
                C:\Program Files\AutocompletePro\support@predictad.com\defaults\preferences\predictad.js (Adware.PredictAd) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\internet.fne (Worm.AutoRun) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\og.dll (Worm.AutoRun) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\og.edt (Worm.AutoRun) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\spec.fne (Worm.AutoRun) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\ul.dll (Worm.AutoRun) -> Quarantined and deleted successfully.

            Discussions similaires

            Que signifie "Utilisateur de Facebook" ?
            Jitgie

            13 réponses
            Récupération compte Facebook sans numéro de téléphone et mot de passe oublié
            RANDRIANASOLO

            1 réponse